Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

rex commands using sed in props.conf on a field

$
0
0

Is there a way to use a rex command with mode=sed against a specific field in a config file (props.conf)?? I understand how to use the SEDCMD in the props but that pre-processes and only appears to go against _raw (since the fields wouldn't be defined yet). Is there a way to do the following: rex mode=sed field=a "s/this/that/g" via config files?? Preferably at search time? Thanks, -Bob


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>